Hardware keystores cut agent key theft from 19% to 0%

A poisoned email pulled private keys out of a widely used AI agent framework in under five minutes, per a new paper.

The keys sat in software storage the agent could read directly. That's the exposure facing any MCP-connected agent with email or file access. A single crafted message can talk it into handing over secrets it's supposed to guard.

The paper's fix is a five-layer zero-trust MCP stack. It ends in a hardware execution boundary, an HSM, TPM, or smart card, that never releases the key itself. The agent gets back an opaque result handle instead, enough to prove an operation ran without holding material that could be exfiltrated.

Tested across four models and 12 injection scenarios, 192 runs in total, the exfiltration success rate dropped from 19.3% to zero. Benign requests still went through with no false positives.

Injection filters treat the symptom. Handle, not key. That's the paper's actual rule: an agent should hold a handle to a capability, never the key material. Any MCP setup that still hands an agent raw secrets is one crafted email away from repeating this exploit.